CVSS: 6.4EPSS: 4%CPEs: 1EXPL: 0CVE-2024-27136 – Apache JSPWiki: Cross-site scripting vulnerability on upload page
https://notcve.org/view.php?id=CVE-2024-27136
24 Jun 2024 — XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later. XSS en la página de carga en Apache JSPWiki 2.12.1 y versiones anteriores permite al atacante ejecutar javascript en el navegador de la víctima y obtener información confidencial sobre la víctima. Los usuarios de Apache JSPWiki deben actualizar a 2.12.2 o posterior. • https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38379 – Apache Allura: Stored authenticated XSS
https://notcve.org/view.php?id=CVE-2024-38379
22 Jun 2024 — Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted. This issue affects Apache Allura: from 1.4.0 through 1.17.0. Users are recommended to upgrade to version 1.17.1, which fixes the issue. La configuración del vecindario de Apache Allura es vulnerable a un ataque XSS almacenado. • https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 3CVE-2024-34693 – Apache Superset: Server arbitrary file read
https://notcve.org/view.php?id=CVE-2024-34693
20 Jun 2024 — Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and versi... • https://github.com/mbadanoiu/CVE-2024-34693 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25142 – Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache
https://notcve.org/view.php?id=CVE-2024-25142
14 Jun 2024 — Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue. Uso de la vulnerabilidad de caché del navegador web que contiene información confidencial en Apache Airflow. • https://github.com/apache/airflow/pull/39550 • CWE-525: Use of Web Browser Cache Containing Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36265 – Apache Submarine Server Core: authorization bypass
https://notcve.org/view.php?id=CVE-2024-36265
12 Jun 2024 — Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. • http://www.openwall.com/lists/oss-security/2024/06/12/3 • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36264 – Apache Submarine Commons Utils: default secret
https://notcve.org/view.php?id=CVE-2024-36264
12 Jun 2024 — Improper Authentication vulnerability in Apache Submarine Commons Utils. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. • http://www.openwall.com/lists/oss-security/2024/06/12/2 • CWE-287: Improper Authentication •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36263 – Apache Submarine Server Core: SQL injection
https://notcve.org/view.php?id=CVE-2024-36263
12 Jun 2024 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. • http://www.openwall.com/lists/oss-security/2024/06/12/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36471 – Apache Allura: sensitive information exposure via DNS rebinding
https://notcve.org/view.php?id=CVE-2024-36471
10 Jun 2024 — Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura from 1.0.1 through 1.16.0. Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file. • https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.1EPSS: 93%CPEs: 1EXPL: 1CVE-2024-36104 – Apache OFBiz: Path traversal leading to a RCE
https://notcve.org/view.php?id=CVE-2024-36104
04 Jun 2024 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue. Limitación inadecuada de una vulnerabilidad de nombre de ruta a un directorio restringido ("Path Traversal") en Apache OFBiz. Este problema afecta a Apache OFBiz: antes del 18.12.14. • https://github.com/ggfzx/CVE-2024-36104 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32077 – Apache Airflow: XSS vulnerability in Task Instance Log/Log Details
https://notcve.org/view.php?id=CVE-2024-32077
14 May 2024 — Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue. Apache Airflow versión 2.9.0 tiene una vulnerabilidad que permite a un atacante autenticado inyectar datos maliciosos en los registros de instancias de tareas. Se recomienda a los usuarios actualizar a la versión 2.9.1, que soluciona este problema. • http://www.openwall.com/lists/oss-security/2024/05/14/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •